Managing risk and information security

208 Pages·2016·5.91 MB·English

Managing risk
and information
security
Protect to Enable
—
Second Edition
—
Malcolm W Harkins
www.hellodigi.ir
Managing Risk and
Information Security
Protect to Enable

Second Edition
Malcolm W. Harkins

www.hellodigi.ir
Managing Risk and Information Security: Protect to Enable
Malcolm W. Harkins
Folsom, California, USA
ISBN-13 (pbk): 978-1-4842-1456-5 ISBN-13 (electronic): 978-1-4842-1455-8
DOI 10.1007/978-1-4842-1455-8
Library of Congress Control Number: 2016949414
Copyright © 2016 by Malcolm W. Harkins
ApressOpen Rights: You have the right to copy, use and distribute this Work in its entirety, electronically without
modification, for non-commercial purposes only. However, you have the additional right to use or alter any source
code in this Work for any commercial or non-commercial purpose which must be accompanied by the licenses in
(2) and (3) below to distribute the source code for instances of greater than 5 lines of code. Licenses (1), (2) and (3)
below and the intervening text must be provided in any use of the text of the Work and fully describes the license
granted herein to the Work.
(1) License for Distribution of the Work: This Work is copyrighted by Malcolm Harkins, all rights reserved. Use
of this Work other than as provided for in this license is prohibited. By exercising any of the rights herein, you
are accepting the terms of this license. You have the non-exclusive right to copy, use and distribute this English
language Work in its entirety, electronically without modification except for those modifications necessary for
formatting on specific devices, for all non-commercial purposes, in all media and formats known now or hereafter.
While the advice and information in this Work are believed to be true and accurate at the date of publication,
neither the authors nor the editors nor the publisher can accept any legal responsibility for any errors or omissions
that may be made. The publisher makes no warranty, express or implied, with respect to the material contained
herein.
If your distribution is solely Apress source code or uses Apress source code intact, the following licenses (2) and (3)
must accompany the source code. If your use is an adaptation of the source code provided by Apress in this Work,
then you must use only license (3).
(2) License for Direct Reproduction of Apress Source Code: This source code, from Intel® Trusted Execution
Technology for Server Platforms, ISBN 978-1-4302-6148-3 is copyrighted by Apress Media, LLC, all rights reserved.
Any direct reproduction of this Apress source code is permitted but must contain this license. The following license
must be provided for any use of the source code from this product of greater than 5 lines wherein the code is
adapted or altered from its original Apress form. This Apress code is presented AS IS and Apress makes no claims
to, representations or warrantees as to the function, usability, accuracy or usefulness of this code.
(3) License for Distribution of Adaptation of Apress Source Code: Portions of the source code provided are used
or adapted from Intel® Trusted Execution Technology for Server Platforms, ISBN 978-1-4302-6148-3 copyright
Apress Media LLC. Any use or reuse of this Apress source code must contain this License. This Apress code is made
available at Apress.com/9781484214565 as is and Apress makes no claims to, representations or warrantees as to
the function, usability, accuracy or usefulness of this code.
Trademarked names, logos, and images may appear in this book. Rather than use a trademark symbol with every
occurrence of a trademarked name, logo, or image we use the names, logos, and images only in an editorial fashion
and to the benefit of the trademark owner, with no intention of infringement of the trademark. The use in this
publication of trade names, trademarks, service marks, and similar terms, even if they are not identified as such, is
not to be taken as an expression of opinion as to whether or not they are subject to proprietary rights.
While the advice and information in this book are believed to be true and accurate at the date of publication,
neither the authors nor the editors nor the publisher can accept any legal responsibility for any errors or omissions
that may be made. The publisher makes no warranty, express or implied, with respect to the material contained
herein.
Cover image designed by Freepik.
Managing Director: Welmoed Spahr
Lead Editor: Robert Hutchinson
Development Editor: James Markham
Editorial Board: Steve Anglin, Pramila Balen, Aaron Black, Louise Corrigan, Jonathan Gennick, Robert
Hutchinson, Celestin Suresh John, Nikhil Karkal, James Markham, Susan McDermott, Matthew Moodie,
Natalie Pao, Gwenan Spearing
Coordinating Editor: Melissa Maldonado
Copy Editor: Mary Behr
Compositor: SPi Global
Indexer: SPi Global
Artist: SPi Global
Distributed to the book trade worldwide by Springer Science+Business Media New York,
233 Spring Street, 6th Floor, New York, NY 10013. Phone 1-800-SPRINGER, fax [phone], e-mail
[email protected] , or visit w ww.springer.com . Apress Media, LLC is a California LLC
and the sole member (owner) is Springer Science + Business Media Finance Inc (SSBM Finance Inc).
SSBM Finance Inc is a Delaware corporation.
For information on translations, please e-mail [email protected] , or visit w ww.apress.com .
Apress and friends of ED books may be purchased in bulk for academic, corporate, or promotional use. eBook
versions and licenses are also available for most titles. For more information, reference our Special Bulk Sales–eBook
Licensing web page at www.apress.com/bulk-sales .
Any source code or other supplementary materials referenced by the author in this text is available
to readers at w ww.apress.com . For detailed information about how to locate your book’s source code, go to www.
apress.com/source-code/ .
Printed on acid-free paper
www.hellodigi.ir
About ApressOpen
What Is ApressOpen?
• ApressOpen is an open access book program that publishes
high-quality technical and business information.
• ApressOpen eBooks are available for global, free,
noncommercial use.
• ApressOpen eBooks are available in PDF, ePub, and Mobi formats.
• The user friendly ApressOpen free eBook license is presented on
the copyright page of this book.
iii
www.hellodigi.ir
www.hellodigi.ir
This book is dedicated to my family.
www.hellodigi.ir
www.hellodigi.ir
Contents at a Glance
Foreword .........................................................................................xv
Praise for the second edition of Managing Risk and
Information Security ......................................................................xvii
About the Author ............................................................................xxi
Acknowledgments ........................................................................xxiii
Preface ...........................................................................................xxv
■ Chapter 1: Introduction ..................................................................1
■ Chapter 2: The Misperception of Risk ..........................................17
■ Chapter 3: Governance and Internal Partnerships:
How to Sense, Interpret, and Act on Risk .....................................31
■ Chapter 4: External Partnerships: The Power of Sharing
Information ...................................................................................49
■ Chapter 5: People Are the Perimeter ............................................65
■ Chapter 6: Emerging Threats and Vulnerabilities:
Reality and Rhetoric .....................................................................81
■ Chapter 7: A New Security Architecture to Improve
Business Agility ............................................................................99
■ Chapter 8: Looking to the Future: Emerging
Security Capabilities ..................................................................117
vii
www.hellodigi.ir
■ CONTENTS AT A GLANCE
■ Chapter 9: Corporate Social Responsibility: The Ethics of
Managing Information Risk ........................................................129
■ Chapter 10: The 21st Century CISO ............................................139
■ Chapter 11: Performance Coaching ............................................155
■ Appendix A: References ..............................................................171
Index ..............................................................................................181
viii
www.hellodigi.ir
Contents
Foreword .........................................................................................xv
Praise for the second edition of Managing Risk and
Information Security ......................................................................xvii
About the Author ............................................................................xxi
Acknowledgments ........................................................................xxiii
Preface ...........................................................................................xxv
■ Chapter 1: Introduction ..................................................................1
Protect to Enable® ...................................................................................5
Building Trust ............................................................................................................8
Keeping the Company Legal: The Regulatory Flood .................................................8
The Rapid Proliferation of Information, Devices, and Things ..................................12
The Changing Threat Landscape ............................................................................13
A New Approach to Managing Risk ........................................................................16
■ Chapter 2: The Misperception of Risk ..........................................17
The Subjectivity of Risk Perception .......................................................18
How Employees Misperceive Risk .........................................................18
The Lure of the Shiny Bauble..................................................................................20
How Security Professionals Misperceive Risk ......................................20
Security and Privacy ...............................................................................................22
How Decision Makers Misperceive Risk ...............................................23
ix
www.hellodigi.ir